python - Chalice:无法通过 pynamodb 连接 DynamoDB

Question

它在配置了 .aws 的本地计算机上运行良好。但是，lambda 无法通过自动生成的 iam 角色连接 dynamodb 表。我什至尝试通过 IAM 控制台向角色显式添加策略:

{
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "dynamodb:*",
            "Resource": "arn:aws:dynamodb:ap-south-1:*:table/*"
}

但仍然收到此错误(调试日志):

An error occurred (AccessDeniedException) on request (SQ60ECK3UMM6LLEBC2K04S6HE7VV4KQNSO5AEMVJF66Q9ASUAAJG) on table (lmk_staging_posts) when calling the DescribeTable operation:
2018-02-26 00:11:18.723000 3ca1b0 [DEBUG]       2018-02-25T18:41:18.722Z                Calling DescribeTable with arguments {'TableName': 'lmk_staging_posts'}
2018-02-26 00:19:16.045000 5e175a [DEBUG]       2018-02-25T18:49:16.45Z         Calling DescribeTable with arguments {'TableName': 'lmk_staging_posts'}
2018-02-26 00:19:16.110000 5e175a [DEBUG]       2018-02-25T18:49:16.110Z                Calling DescribeTable with arguments {'TableName': 'lmk_staging_comments'}
2018-02-26 00:19:16.157000 5e175a [DEBUG]       2018-02-25T18:49:16.157Z                Calling DescribeTable with arguments {'TableName': 'lmk_staging_groups'}
2018-02-26 00:19:16.200000 5e175a [DEBUG]       2018-02-25T18:49:16.199Z                Calling DescribeTable with arguments {'TableName': 'lmk_staging_user_profile'}

Answer 1

您必须将 "autogen_policy":false 添加到 config.json 并将所有策略放入policy-dev.json，例如:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "s3:*",
        "dynamodb:*"
      ],
      "Resource": "*"
    }
  ]
}

通过这种方式，您可以手动设置策略。